Data Processing & Security

For account and billing data relating to you as a Servstead customer, Servstead is the controller.

For Customer Content and end-customer personal data you upload or generate while using the Service for your business, you are the controller and Servstead acts as your processor/service provider, processing data only on your documented instructions through your use of the Service.

We store account credentials, business settings, customer and job records, financial documents you create, uploaded photos and attachments, team activity, portal access logs, integration tokens where authorized, and system metadata needed to operate the Service.

Job records may remain available even when associated files are deleted or exported, depending on product behavior and your actions.

You are responsible for: (a) obtaining any required consents from your customers, employees, and contractors; (b) providing appropriate privacy notices to your customers; (c) configuring team permissions appropriately; (d) maintaining your own backups when required for your business or legal obligations; and (e) ensuring data you upload is accurate and lawful.

We use industry-standard measures including TLS 1.2+ encryption in transit, encryption at rest via our cloud database provider, unique user accounts, role-based access within the application, PostgreSQL row-level security for tenant isolation, and authenticated access to production infrastructure.

Administrative access to production systems (cloud hosting, database, payment, and integration dashboards) requires multi-factor authentication and least-privilege permissions.

See our Information Security Policy at https://servstead.com/policies/security for additional detail.

We use trusted infrastructure and service providers to operate Servstead. Major subprocessors include: Supabase (Database, authentication, file storage, and row-level security; United States); Vercel (Application hosting, TLS termination, and edge delivery; United States); Stripe (Subscription billing and customer payment processing; United States); Plaid (Optional read-only bank transaction sync when a business owner connects their account; United States); Resend (Transactional email delivery; United States); OpenAI (Optional AI-assisted estimates when you use AI features; United States).

These providers process data only to deliver their contracted services. We may update subprocessors as the Service evolves; material changes will be reflected in this policy.

Data may be stored and processed in the United States and other regions where our providers operate. We target commercially reasonable availability but do not guarantee uninterrupted access.

We maintain operational backups for disaster recovery. Backups are not a substitute for your own export strategy. You may export records through in-product export tools where available.

We are not liable for loss of Customer Content caused by your deletion, account closure, integration misconfiguration, third-party outage, or events outside our reasonable control.

If we become aware of a confirmed security incident affecting personal information in our control, we will notify you without undue delay where required by law and provide information reasonably available to help you meet your obligations.

Upon termination or your written request, we will delete or anonymize Customer Content within ninety (90) days, subject to legal retention requirements. Plaid access tokens and synced bank transactions are removed when you disconnect the integration or close your account.

Residual copies may persist temporarily in encrypted backups for up to thirty (30) days before routine purge.

When you use AI-assisted features, prompts and relevant business context may be transmitted to AI providers to generate responses. Do not submit sensitive personal data you are not authorized to share. AI outputs must be reviewed by you before customer-facing use.

Data and security questions: servstead@gmail.com. Security reports and diligence: servstead@gmail.com.